Methods, apparatus and data structures for segmenting customers using at least a portion of a layer 2 address header or bits in the place of a layer 2 address header

• US 20050157664A1
• Filed: 12/03/2004
• Published: 07/21/2005
• Est. Priority Date: 08/31/2000
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Communications Inc.
• Inventors: Voit, Eric A., Baum, Robert T.
• Granted Patent: US 7,839,802 B2
• Time in Patent Office: Days
• US Class Current: 370/256
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Limiting or controlling access to various services thereby performing a firewall function. An access router may permit or deny a packet based on at least a portion of a unique bit string (or context information) which replaced layer 2 header information (e.g., the layer 2 (e.g., MAC) address). Further, a particular quality of service may be indicated by at least a part of the unique bit string (or context information). The service provided to a group of customers, that group of customers being defined by at least a portion of the unique bit string (or context information), may be monitored. Multicast groups may be supported by checking at least a part of the unique bit string (or context information) to determine whether or not a customer associated with that port is permitted to join the multicast group.

Claims

1. A method for provisioning services to packets sourced from a number of client devices, the method comprising:

a) accepting a packet sourced from one of a number of client devices, wherein the packet has had at least a part of a layer 2 header replaced with a unique bit string that is independent of any contents of the packet,

b) determining whether or not the packet is entitled to access a particular service using at least a portion of the unique bit string; and

c) if it is determined that the packet is entitled to access the particular service, then routing the packet.

2. The method of claim 1 wherein at least a portion of the unique bit string represents one of a number of logical interfaces.

3. The method of claim 1 wherein at least a portion of the unique bit string corresponds to a virtual private network-organizational universal identifier.

4. The method of claim 1 wherein at least a portion of the unique bit string corresponds to a virtual private network-INDEX.

16. The method of claim 1 wherein at least a portion of the unique bit string represents a logical port identifier including a geographic location identifier and a physical unit identifier.

25. The method of claim 1 wherein the step of determining whether or not the packet is entitled to access a particular service using at least a portion of the unique bit string is a separate determination from determining whether or not the packet can be forwarded.

26. The method of claim 1 wherein the packet is routed only if it is determined that the packet is entitled to access the particular service.

5. A method for providing various quality of service levels to packets sourced from a number of client devices, the method comprising:

a) accepting a packet sourced from one or a number of client devices, wherein the packet has had at least a part of a layer 2 header replaced with a unique bit string that is independent of any contents of the packet;

b) determining a service level to which the packet is entitled using at least a portion of the unique bit string; and

c) forwarding the packet to a particular one of a plurality of queues associated with the service level determined.

6. The method of claim 5 wherein at least a portion of the unique bit string represents one of a number of logical interfaces.

7. The method of claim 5 wherein at least a portion of the unique bit string corresponds to a virtual private network-organizational universal identifier.

8. The method of claim 5 wherein at least a portion of the unique bit string corresponds to a virtual private network-INDEX.

17. The method of claim 5 wherein at least a portion of the unique bit string represents a logical port identifier including a geographic location identifier and a physical unit identifier.

27. The method of claim 5 wherein the service level is a quality of service level.

28. The method of claim 5 wherein the service level is a quality of service level represented by a plurality of bits.

9. A method for monitoring packets sourced from a group of client devices defining a subset of client devices, each of the packets having at least a part of a layer 2 header replaced with a unique bit string, the method comprising:

a) determining whether or not the packet belongs to the group of client devices using at least a portion of the unique bit string; and

b) if it is determined that the packet does belong to the group of client devices, then

i) copying the packet to generate a duplicate packet, and

ii) forwarding the duplicate packet to a monitoring facility, wherein the monitoring facility monitors at least one of (A) service provided to a group of customers, and (B) security.

10. The method of claim 9 wherein at least a portion of the unique bit string represents one of a number of logical interfaces.

11. The method of claim 9 wherein at least a portion of the unique bit string corresponds to a virtual private network-organizational universal identifier.

12. The method of claim 9 wherein at least a portion of the unique bit string corresponds to a virtual private network-INDEX.

18. The method of claim 9 wherein the unique bit string is independent of a layer 2 destination address.

19. The method of claim 9 wherein at least a portion of the unique bit string represents a logical port identifier including a geographic location identifier and a physical unit identifier.

13. An apparatus for provisioning services to packets sourced from a number of client devices, each of the packets having at least a part of a layer 2 header replaced with a unique bit string, the apparatus comprising:

a) an access control list; and

b) an access controller, the access controller including

i) means for determining whether or not the packet is entitled to access a particular service using

A) contents of the access control list, and

B) at least a portion of the unique bit string, and

ii) means for routing the packet only if it is determined that the packet is entitled to access the particular service.

20. The method of claim 13 wherein the unique bit string is independent of a layer 2 destination address.

21. The method of claim 13 wherein at least a portion of the unique bit string represents a logical port identifier including a geographic location identifier and a physical unit identifier.

14. An apparatus for providing various service levels to packets sourced from a number of client devices, each of the packets having at least a part of a layer 2 header replaced with a unique bit string that is independent of contents of the packets, the apparatus comprising:

a) a plurality of queues, each of the plurality of queues associated with a particular service level;

b) a service level list; and

c) a service level controller, the service level controller including

i) means for determining a service level to which the packet is entitled using

A) contents of the service level list, and

B) at least a portion of the unique bit string, and

ii) means for forwarding the packet to the one of the plurality of queues associated with the quality of service level determined.

22. The method of claim 14 wherein at least a portion of the unique bit string represents a logical port identifier including a geographic location identifier and a physical unit identifier.

15. An apparatus for monitoring packets sourced from a group of client devices defining a subset of client devices, each of the packets having at least a part of a layer 2 header replaced with a unique bit string, the apparatus comprising:

a) a monitoring port for accepting packets of the group of client devices to be monitored;

b) means determining whether or not an accepted packet belongs to the group of client devices using at least a portion of the unique bit string; and

c) means for

i) copying the accepted packet to generate a duplicate packet, and

ii) forwarding the duplicate packet to the monitoring port so that at least one of (A) service to a group of customers, and (B) security, may be monitored

if it is determined that the packet was sourced by a client device belonging to the group of client devices.

23. The method of claim 15 wherein the unique bit string is independent of a layer 2 destination address.

24. The method of claim 15 wherein at least a portion of the unique bit string represents a logical port identifier including a geographic location identifier and a physical unit identifier.

29. A method for provisioning services to packets sourced from a number of client devices, the method comprising:

a) accepting a packet sourced from one of the number of client devices;

b) replacing at least a part of a layer 2 header of the packet with a unique bit string that is independent of any contents of the packet;

c) determining whether or not the packet is entitled to access a particular service using at least a portion of the unique bit string; and

d) if it is determined that the packet is entitled to access the particular service, then routing the packet.

30. A method for providing various quality of service levels to packets sourced from a number of client devices, the method comprising:

a) accepting a packet sourced from one of the number of client devices;

b) replacing at least a part of a layer 2 header of the packet with a unique bit string that is independent of any contents of the packet;

c) determining a service level to which the packet is entitled using at least a portion of the unique bit string; and

d) forwarding the packet to a queue associated with the service level determined.